lkn
/
anvillm
Archived
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Document default sandbox selection: anvilmcp with fallback to default

This commit is contained in:
Levi Neely 2026-03-18 23:44:13 +01:00
parent 2dc9961bea
commit 7c7d2de1e3
2 changed files with 8 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
docs/code-execution-security-guide.md
View File

@ -174,6 +174,10 @@ Validation is basic pattern matching. Not comprehensive - relies on sandbox for
## Configuration ## Configuration
### Sandbox Selection
By default (when the `sandbox` argument is not specified), `execute_code` uses the restricted `anvilmcp` sandbox configuration. If this fails (e.g., due to kernel or permission constraints), it falls back to the `default` sandbox — the same configuration used by the outer landrun invocation. This compromise provides "just works" behavior and avoids surprises, while still applying the tighter sandbox when possible.
### Adjusting Timeout ### Adjusting Timeout
Default: 30 seconds Default: 30 seconds

4
docs/code-execution-security.md
View File

@ -314,6 +314,10 @@ import { evil } from "/etc/passwd";
## Subprocess Configuration ## Subprocess Configuration
### Sandbox Selection
By default (when the `sandbox` argument is not specified), `execute_code` uses the restricted `anvilmcp` sandbox configuration. If this fails (e.g., due to kernel or permission constraints), it falls back to the `default` sandbox — the same configuration used by the outer landrun invocation. This compromise provides "just works" behavior and avoids surprises, while still applying the tighter sandbox when possible.
### bash Permissions ### bash Permissions
```bash ```bash